CVE Feed

    Dashboard / CVE / CVE-2021-41179

    CVE-2021-41179

    Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and 22.2.0, the Two-Factor Authentication wasn't enforced for pages marked as public. Any page marked as `@PublicPage` could thus be accessed with a valid user session that isn't authenticated. This particularly affects the Nextcloud Talk application, as this could be leveraged to gain access to any private chat channel without going through the Two-Factor flow. It is recommended that the Nextcloud Server be upgraded to 20.0.13, 21.0.5 or 22.2.0. There are no known workarounds aside from upgrading.

    Published:Oct 25, 2021
    Last Modified:Nov 21, 2024
    EPS:Oct 25, 2021
    EPSS Score:0.0038
    CVSS Score:6.5

    Affected Products

    Vendor
    Nextcloud
    Product
    Server

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2025-64011 (CVSS 4.3) — Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpo…
    CVE-2025-66552 (CVSS 4.3) — Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30…
    CVE-2025-66547 (CVSS 4.3) — Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31…
    CVE-2025-66512 (CVSS 5.4) — Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Server Enterprise prior to 31…
    CVE-2025-66510 (CVSS 4.5) — Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and N…
    CVE-2024-37313 (CVSS 7.3) — Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the…
    CVE-2023-39962 (CVSS 7.7) — Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 19.0.…
    CVE-2021-41178 (CVSS 8.8) — Nextcloud is an open-source, self-hosted productivity platform. Prior to versions 20.0.13, 21.0.5, and 22.2.0,…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High